3L-SAV: A Three-Layer Intra-Domain Source Address Validation Framework for Hierarchical Operator Networks

IP source address spoofing is commonly used in malicious attacks, such as Distributed Denial-of-Service (DDoS) amplification attacks. It can jeopardize network operations and cause substantial economic losses to network operators and their customers. However, existing source address validation (SAV) solutions have technical limitations in terms of accuracy and deployability, leading to the reluctance of network operators to deploy SAV in their networks. In this paper, we propose a threelayer intra-domain SAV framework (i.e., 3L-SAV) for hierarchical operator networks. Routers on different layers can generate accurate SAV rules by using topology and prefix information learned from the intra-domain routing protocol. Our evaluations show that 3L-SAV effectively discards spoofed packets from the rest of the Internet as well as user networks and only increases router storage memory by $8 \%$.